CVE-2026-115927
Deferred Deferred - Pending Action

Tornado HTTP/1.1 Chunked Transfer Encoding DoS

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115927
EUVD
EUVD-2026-110077

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tornadoweb tornado < 6.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-115927 is a denial-of-service vulnerability in Tornado, a Python web framework. It occurs when HTTP/1.1 chunked transfer encoding bodies contain millions of one-byte chunks. The framework processes these chunks without yielding to the event loop, allowing an attacker to monopolize the process event loop and stall other connections. This consumes excessive memory and blocks the server for up to a minute per request.

Detection Guidance

Monitor for unusually high CPU usage or stalled connections in Tornado applications. Check for excessive memory consumption from many small HTTP chunks. Use network traffic analysis tools to detect abnormal chunked transfer encoding patterns with millions of 1-byte chunks.

Impact Analysis

An attacker can send malicious requests to slow down or crash your Tornado server, delaying responses for all users. Memory usage may spike up to 20 times the actual data size. SimpleAsyncHTTPClient is also affected when reading responses from malicious servers. Workarounds include upgrading to Tornado 6.6.0 or using a reverse proxy to buffer bodies.

Mitigation Strategies

Upgrade Tornado to version 6.6.0 or later. Configure a reverse proxy to buffer request bodies before they reach Tornado. Reduce max_body_size to limit impact, though this does not fully fix the issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115927. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart